Fedora 43 : yq (2026-990cdd8329)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-990cdd8329 advisory. Update to 4.53.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2026-54567

creationtimestamp| type| source ---|---|--- 2026-07-17 22:35:08+00:00| published-proof-of-concept| https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg...

CVE-2026-54570

creationtimestamp| type| source ---|---|--- 2026-07-17 22:35:05+00:00| published-proof-of-concept| https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg...

CVE-2026-55177

creationtimestamp| type| source ---|---|--- 2026-07-17 22:35:03+00:00| published-proof-of-concept| https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-r95q-fp26-h3hc...

GHSA-FF9F-JF42-662Q

creationtimestamp| type| source ---|---|--- 2026-07-17 21:19:56+00:00| seen| https://chaos.social/users/christopherkunz/statuses/116937404931312120 2026-07-20 13:00:41+00:00| seen| https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar 2026-07-20...

CVE-2026-54490 websocket-driver: Resource limit bypass via message compression

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked...

CVE-2026-54549

creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:08+00:00| published-proof-of-concept| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-45gf-fjxp-cjpq...

CVE-2026-54547

creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:06+00:00| published-proof-of-concept| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56...

CVE-2026-54546

creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:03+00:00| published-proof-of-concept| https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v...

GHSA-5G35-5JRJ-F39P vulnerabilities

Vulnerabilities for packages: perl...

GHSA-5CVC-PM9V-PW7P vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15776 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-QPX7-R6J6-CQF3 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-XXVR-RJCX-VQW8 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-54464 websocket-driver: Resource limit bypass via message compression

Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...

GO-2026-5968 melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko...

CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identified CVE-2026-11400, an issue in Aurora PostgreSQL using the AWS Advanced JDBC Wrapper Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege...

plone.restapi: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

CVE-2026-47870

creationtimestamp| type| source ---|---|--- 2026-07-17 16:15:18+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-712 2026-07-18 12:01:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqw7rnnoqs23...